Skip to content

C0051 APT28 Nearest Neighbor Campaign

APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.1

Item Value
ID C0051
Associated Names
First Seen February 2022
Last Seen November 2024
Version 1.0
Created 25 February 2025
Last Modified 10 March 2025
Navigation Layer View In ATT&CK® Navigator

Groups

ID Name References
G0007 APT28 APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024.1

Techniques Used

Domain ID Name Use
enterprise T1560 Archive Collected Data -
enterprise T1560.001 Archive via Utility During APT28 Nearest Neighbor Campaign, APT28 used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data.1
enterprise T1110 Brute Force -
enterprise T1110.003 Password Spraying During APT28 Nearest Neighbor Campaign, APT28 performed password-spray attacks against public facing services to validate credentials.1
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.001 PowerShell During APT28 Nearest Neighbor Campaign, APT28 used PowerShell cmdlet Get-ChildItem to access credentials, among other PowerShell functions deployed.1
enterprise T1059.003 Windows Command Shell During APT28 Nearest Neighbor Campaign, APT28 used cmd.exe for execution.1
enterprise T1584 Compromise Infrastructure During APT28 Nearest Neighbor Campaign, APT28 compromised third-party infrastructure in physical proximity to targets of interest for follow-on activities.1
enterprise T1074 Data Staged -
enterprise T1074.001 Local Data Staging During APT28 Nearest Neighbor Campaign, APT28 staged captured credential information in the C:\ProgramData directory.1
enterprise T1140 Deobfuscate/Decode Files or Information During APT28 Nearest Neighbor Campaign, APT28 unarchived data using the GUI version of WinRAR.1
enterprise T1006 Direct Volume Access During APT28 Nearest Neighbor Campaign, APT28 accessed volume shadow copies through executing vssadmin in order to dump the NTDS.dit file.1
enterprise T1561 Disk Wipe -
enterprise T1561.001 Disk Content Wipe During APT28 Nearest Neighbor Campaign, APT28 used the native Microsoft utility cipher.exe to securely wipe files and folders – overwriting the deleted data using cmd.exe /c cipher /W:C.1
enterprise T1567 Exfiltration Over Web Service During APT28 Nearest Neighbor Campaign, APT28 exfiltrated data over public-facing webservers – such as Google Drive.1
enterprise T1562 Impair Defenses -
enterprise T1562.004 Disable or Modify System Firewall During APT28 Nearest Neighbor Campaign, APT28 added rules to a victim’s Windows firewall to set up a series of port-forwards allowing traffic to target systems.1
enterprise T1003 OS Credential Dumping -
enterprise T1003.002 Security Account Manager During APT28 Nearest Neighbor Campaign, APT28 used the following commands to dump SAM, SYSTEM, and SECURITY hives: reg save hklm\sam, reg save hklm\system, and reg save hklm\security.1
enterprise T1003.003 NTDS During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via vssadmin.1
enterprise T1090 Proxy -
enterprise T1090.001 Internal Proxy During APT28 Nearest Neighbor Campaign, APT28 used the built-in netsh portproxy command to create internal proxies on compromised systems.1
enterprise T1021 Remote Services -
enterprise T1021.001 Remote Desktop Protocol During APT28 Nearest Neighbor Campaign, APT28 used RDP for lateral movement.1
enterprise T1021.002 SMB/Windows Admin Shares During APT28 Nearest Neighbor Campaign, APT28 leveraged SMB to transfer files and move laterally.1
enterprise T1016 System Network Configuration Discovery -
enterprise T1016.002 Wi-Fi Discovery During APT28 Nearest Neighbor Campaign, APT28 collected information on wireless interfaces within range of a compromised system.1
enterprise T1669 Wi-Fi Networks During APT28 Nearest Neighbor Campaign, APT28 established wireless connections to secure, enterprise Wi-Fi networks belonging to a target organization for initial access into the environment.1

Software

ID Name Description
S1205 cipher.exe APT28 1
APT28 Nearest Neighbor Campaign 1 S0108
APT28 Nearest Neighbor Campaign1

References

  1. Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩